Weekly Privacy Roundup, 11 to 17 October 2026
, UK
, Norway
| Weekly update11 to 17 October 2026
Smart Glasses: Recording Should Be Obvious
On 13 October the European Data Protection Board published an initial statement on smart glasses, which contain cameras and microphones. Under the statement, neither the manufacturer nor the service provider can transfer their obligations to users. According to the EDPB Chair, the glasses should make recording obvious, for instance with bright LED lights or audio signals, and the risks are greater in hospitals, schools and workplaces. This is preliminary guidance, not legislation or an enforcement decision.
What it means for organisations
Anyone considering these devices should decide where they may be used, how bystanders will be alerted, what will be retained and where the data will go.
An External Tool Does Not Bypass Approval
On 14 October the UK data protection authority announced a reprimand and an enforcement notice, issued on 23 September to the Metropolitan Police Service. Between March 2023 and September 2024, officers and staff used a third-party retail crime intelligence-sharing platform that the force had not approved. Around 500 accounts were created, and information about 179 people, three of them under 18, was uploaded. The notice requires the force to strengthen how it identifies, assesses and approves third-party services, review its controls, improve governance and enhance staff awareness.
What it means for organisations
Supplier review is not enough if employees can start using a service before its purpose, permissions and oversight are defined.
Consent Accountability Cannot Be Passed Along
The Norwegian Data Protection Authority fined the advertising technology company Xandr, now part of Microsoft, EUR 8.6 million. Xandr processed personal data of users of the dating app Grindr in real-time bidding, including the fact that they used the app, which is data concerning sexual orientation. The authority found that Xandr was a joint controller and could not rely on the consent collected by the app: each joint controller must independently verify that consent is valid and covers its own processing. The final decision was issued on 2 October and published by the EDPB on 16 October.
What it means for organisations
Advertisers and ad tech providers should know what data enters each advertising chain, who relies on which consent, and whether that consent covers each party's processing.
General information, not legal advice. Check the official source before relying on it.